Incident Overview
On August 26, 2025, threat actors exploited OAuth tokens stolen from Salesloft’s Drift AI chatbot integration to access and exfiltrate data from hundreds of Salesforce customer instances. The campaign, attributed to the actor tracked as UNC6395, began as early as August 8, 2025, and continued through at least August 18, 2025. The attackers systematically extracted support tickets, customer data, and other sensitive information from Salesforce environments, including those of prominent organizations such as Cloudflare, Palo Alto Networks, and Zscaler. The primary objective of the threat actor was credential harvesting, with a focus on extracting AWS access keys, passwords, and Snowflake-related tokens from the compromised data.
The breach originated from the misuse of OAuth tokens associated with the Salesloft Drift application, which was integrated with Salesforce via the Salesforce AppExchange. Salesforce revoked all Drift-related tokens and temporarily removed the Drift application from AppExchange on August 20, 2025, to contain the incident. This incident marks the largest known breach to date involving an AI vendor integration, highlighting the risks posed by third-party access to enterprise systems.
The threat actor’s activities included querying Salesforce objects such as Cases, Accounts, Users, and Opportunities. For example, queries were executed to retrieve user details, including usernames, email addresses, and login histories. After exfiltrating the data, the actor searched for secrets embedded within the extracted information, such as AWS access keys (AKIA), passwords, and Snowflake credentials. Despite operational security measures like deleting query jobs, logs remained intact, allowing organizations to detect unauthorized access.
The scope of the compromise extended beyond Salesforce integrations. On August 28, 2025, Google Threat Intelligence Group (GTIG) confirmed that the same threat actor had also compromised OAuth tokens for the ‘Drift Email’ integration, enabling limited access to a small number of Google Workspace accounts. However, this access was restricted to accounts explicitly configured for Salesloft Drift integration and did not affect broader Google Workspace domains. Google revoked the compromised tokens and disabled the integration pending further investigation.
Salesloft engaged Mandiant to investigate the incident, which spanned from March 22, 2025, to September 5, 2025. The investigation revealed that the threat actor had accessed Salesloft’s GitHub account between March and June 2025, downloading repository content, adding guest users, and establishing workflows. Mandiant confirmed no ongoing compromise of the Drift product or evidence of lateral movement into the Salesloft environment beyond limited reconnaissance. The investigation also verified technical segmentation between Drift and Salesloft applications, ensuring the breach did not extend to Salesloft’s broader infrastructure.
In response to the incident, Salesloft implemented extensive remediation measures, including credential rotation for OAuth tokens, employee passwords, and application secrets. The Drift application was taken offline on September 6, 2025, for hardening efforts, such as enhancing logging, upgrading authentication methods, and restricting privileges. The Salesforce integration was restored on an unspecified date following data reconciliation with affected customers. As of September 30, 2025, Drift was brought back online with additional security controls in place, though third-party integrations were restored incrementally.
Salesloft and Salesforce advised organizations to treat any data accessed via Drift integrations as potentially compromised. Immediate actions recommended included revoking and rotating credentials, reviewing third-party integrations for signs of unauthorized access, and searching for exposed secrets within integrated platforms. Organizations were also advised to restrict connected app scopes, enforce IP restrictions, and disable unnecessary API permissions to mitigate future risks.
Possible Root Cause
The root cause of the incident traces back to the compromise of OAuth tokens associated with the Salesloft Drift application. The threat actor, identified as UNC6395, exploited these tokens to gain unauthorized access to Salesforce customer instances. The investigation by Mandiant revealed that the actor had accessed Salesloft’s GitHub account between March and June 2025, suggesting an earlier phase of reconnaissance and preparation.
The initial access likely involved the misuse of Salesloft GitHub Personal Access Tokens (PATs), which were used to enumerate secrets and exfiltrate environment variables and code repositories. These tokens provided the actor with the necessary credentials to interact with Salesloft’s systems and subsequently target Drift integrations. The actor’s ability to manipulate GitHub workflows and add guest users further indicates a prolonged period of access before the actual data exfiltration campaign began in August 2025.
The compromise of OAuth tokens for the Drift-Salesforce integration allowed the actor to execute queries against Salesforce objects, extracting sensitive data without detection for an extended period. The lack of immediate detection highlights gaps in monitoring and logging for third-party access, which the actor exploited to evade discovery.
While the Mandiant investigation did not identify a vulnerability within the core Salesforce platform, the incident exposed weaknesses in Salesloft’s credential management and integration security. The use of overly permissive OAuth scopes and the absence of strict IP restrictions or session timeouts contributed to the breach’s success. Additionally, the actor’s ability to delete query jobs while leaving logs intact demonstrates a deliberate effort to obscure activity, though forensic analysis still provided critical evidence of the intrusion.
Takeaways
- Organizations must conduct rigorous audits of third-party integrations, particularly those involving AI-driven tools like chatbots. The incident demonstrates how compromised OAuth tokens can serve as a gateway to broader enterprise systems, emphasizing the need for continuous monitoring of integration permissions and access logs.
- The compromise of GitHub PATs and OAuth tokens underscores the importance of rotating credentials regularly, disabling unused tokens, and enforcing multi-factor authentication for privileged access. Organizations should also implement tools to detect and prevent the exposure of secrets in code repositories and environment variables.
- Restricting access scopes for third-party applications is essential. The threat actor’s ability to query multiple Salesforce objects suggests that overly permissive OAuth scopes were in place. Organizations should adopt the principle of least privilege, granting integrations only the minimum access required to perform their functions.
- Logging and monitoring must extend to third-party integrations. The actor’s deletion of query jobs did not erase all traces of activity, but the absence of proactive monitoring delayed detection. Organizations should implement real-time alerts for unusual API activity, particularly from anonymizing networks like TOR, and regularly review logs for signs of unauthorized access.
- The rapid revocation of tokens and temporary removal of the Drift application from AppExchange demonstrated effective containment, but organizations must prepare for scenarios where vendor integrations become compromised.
- Vendors and customers must collaborate on security hardening. The incident revealed that Salesloft and Salesforce worked together to revoke tokens, restore integrations, and implement additional security controls.
- The blast radius of AI vendor integrations can be significant. This incident affected hundreds of Salesforce tenants, including major cybersecurity firms, illustrating how a single compromised integration can lead to widespread data exposure. Organizations should assess the potential impact of third-party breaches on their ecosystems and prioritize security measures accordingly.
- Mandiant’s investigation confirmed that the threat actor conducted reconnaissance for months before launching the data exfiltration campaign.